Can you explain how upstream close when http2 client or stream closed prematurely?

Event if ngx_http_v2_close_stream_handler() is indeed called while an upstream connection is running (this shouldn't happen, as ngx_http_process_request() will set its own handlers), the ngx_http_free_request() will run cleanup handlers which will correctly close the upstream connection. As such, the scenario you describe is clearly not possible with vanilla nginx code.

On the other hand, the segmentation fault and errors shown can be easily triggered by a bug in a 3rd party module, or your local code modifications.

I'm closing this, as clearly this is not something can be diagnosed as an nginx problem, and more likely a problem in the external code. If you'll be able to reproduce this using unmodified nginx without 3rd party modules, please reopen this ticket with additional details.